Netwitness Integration! AWESOME!!

We had our last Threat Day of the year the other day, and after the day ended, we were invited to see how a local group uses intelligence pulled from Red Sky Alliance and ThreatRecon.  They integrated it into Netwitness and it was VERY cool!

Apparently they parse everything that needs parsing, and pull from Threat Recon, drop it into Netwitness, and away they go.  When they pulled up the analysis screen, the proof was in the pudding. We had our share of hits for the day, and we started pulling.

We've heard stories - Maltego transforms, CRITS, Splunk, ThreatConnect and now Netwitness. To see it running operationally in someone's environment... This makes me really happy!

BT BT

On Friday we had the opportunity to speak with someone directly involved in Ukraine.  We'll definitely be updating our deck.  The guy definitely filled in some holes!

• One of the things I heard was a story about how smart televisions were hacked to block channels and broadcast "aggressor" television.  
• And the idea that webcams were hacked and used for intelligence doesn't surprise me, but to hear that someone non-military knew about it shocked me.  

In the US, we don't think about the fake fire hydrant with the we web cam built in or the unmarked traffic cams, but the idea that a civilian knows that someone uses these cameras to have up to the minute intelligence, correlating it with full monitoring in the telephone systems (landline and GSM)... wow.

BT BT

So we're heading into the end of the year.. Roughly three weeks left. As we head into the remainder of the year, we're putting on the push for final memberships and new Wapack Labs subscribers.
If you've been thinking about joining us, now's the time. We've been talking with a ton of folks who seemingly are anxious to get some last minute security spend before the years end, and we're happy to offer really good terms.

If you've been thinking about calling us, do it now.

Have a great weekend!
Jeff

13 strategies Ukrainian hacktivists use in their cyber war. Legal or tolerated.

Several Ukrainian hacktivist groups were (are) active on the Ukrainian side of the battle this year in their ongoing conflict with Russia. As Eugene Dokukin and his "Ukranian Cyber Forces" are pretty open on what they are doing, let's look at their 13 stragegies, as there appear to be striking similarities to what CyberBerkut is doing on the Russian side. Also interesting to consider is how these groups manage to keep doing things that are more than likely illegal in their countries, and how the military can use them when needed.

Background: “Ukrainian cyber forces and individual pro-Ukrainian hackers have maintained online attacks on all Internet resources linked to insurgents in the eastern part of the country, whom the Kyiv (Kiev) government deems as terrorists. As of early November, the cyber forces claimed to have downed 46 sites belonging to the breakaway pro-Russian states of the Lugansk People’s Republic (LNR) and the Donetsk People’s Republic (DNR) via multiple denial-of-service (DDoS) attacks. The cyber warfare operation, titled “Retribution,” has been ongoing since mid-2014. Last month, pro-Ukrainian hackers leaked secret documents from the DNR, representatives of Russian nationalist organizations in Crimea, and representatives of government agencies from the Russian Federation. http://uadn.net/2014/11/17/pro-ukrainian-cyber-forces-take-down-46-separatist-sites-and-target-online-money-accounts/

Pro-Ukraine hackers target e-currency accounts. The anti-insurgency cyber campaign has also moved beyond site attacks, with hackers targeting the financial networks of the DNR and LNR. A hacker at the forefront of pro-Ukraine cyber warfare efforts, Yevgeny Dokukin, has announced on his Facebook page that he managed to convince Russian online payment service Yandex Money to block the e-wallet of a notable group of DNR and LNR supporters last month. “Via my actions, I managed to stop the financing of terrorism through the Yandex Money system,” noted Dokukin via social media. However, fellow Russian electronic currency service WebMoney refused to cooperate with his blocking request. http://uadn.net/2014/11/17/pro-ukrainian-cyber-forces-take-down-46-separatist-sites-and-target-online-money-accounts/

- screenshot with Ukrainian Cyber Forces logo from their Youtube channel.

In the article on uapress[.]info/ru/news/show/48475 Ukrainian Cyber Force leader Eugene Dokukin post 13 strategies his group was using in this cyber war during last 6 months.

1. Hacking separatists and terrorists sites.
2. Operation Retribution - blocking terrorists sites with DDoS attacks.
3. Locking the accounts of terrorists in electronic payment systems.
4. Operation CyberStorm – locking phones with short messages flood.
5. Operation CyberHurricane - locking phones with calls flood.
6. Operation “Restore the Truth” - editing Wikipedia to counter Russian propaganda.
7. Operation “Blocked Freaks” - blocking blogs (particularly in livejournal) and sites of terrorists through support requests to livejournal and hosters.
8. Operation Bender - calling terrorists with threats and misinformation.
9. Operation “CyberStorm 2” - sending short messages with threats, disinformation and propaganda.
10. Operation “Bond, James Bond” - espionage operation, which involves listening to and recording audio and video information from the various headquarters of terrorists and webcams in Donbass and Crimea.
11. Operation “Turn off the Propaganda” - opposition to videos from terrorists on YouTube and other video hosting sites.
12. Operation “Crimea is Ukraine” - the return of control over all the Crimean government sites (preferably all Crimean sites in the domain zone ua). And spreading propaganda in Crimea through these sites.
13. Operation “Hunting for Trolls” - blocking accounts, pages and groups of terrorists and trolls in social networks.

As we can see some of these methods are copied from what (pro)Russian cyber forces were using earlier these year against Ukrainians. Like CyberShtorm, CyberStorm 2 and CyberHurricane are similar in effect to Telephony Denial of Service (TDoS) attacks that we reported earlier... Only this time it's the Ukrainian side which using it.

Eugene Dokukin is now open about his identity and gives interviews. When asked how they do things which are illegal according Ukrainian law he smiles: “Most of our work is legal. Closing accounts, websites and other resources of terrorists through complaints to electronic payment system, domain and hosting providers, etc. - it's all legal. The only question may arise about hacking: hacking sites, email and social network accounts, as well as DDoS attacks on websites terrorists. But officially, I don't know who of all of the fighters does it.” (http://uapress.info/ru/news/show/48475 - in Russian)

In general Eugene Dokukin says that there're three levels in his forces: those volunteers who do legal things like Wikipedia editing and writing complains to providers, those who do illegal but simple things like DDoS attacks and other flooding, and the highest level on his group are people who do real hacking.

Speaking about his enemies Eugene Dukinin cites SBU head Valentin Nalivaychenko information that in Russian
FSP 18^th Special Center there are 1500 personnel working full day use automatic systems for social networks to send messages and texts spreading panic. (http://uapress.info/ru/news/show/48475 - in Russian)

  

Eugene Dokukin (Yevgeny Dokukin, Rus. Евгений Докукин) aka MastLive

https://www.facebook.com/eugene.dokukin

http://websecurity.com[.]ua

He has a “white hacker” background (http://www.interpretermag.com/hackers-join-in-the-struggle-for-crimea/). Before creating Ukrainian Cyber Forces Eugene Dokukin was active in March fighting Russian invasion. He hacked Crimean Parliament site and posted  "The referendum is canceled. Crimea continues to be a part of Ukraine. Everyone can go home, and Russian troops can return to their country." A few days later Dokukin also “dismissed” pro-Russian Crimean leaders Aksenov (prime-minister) and Konstantinov (speaker). Ukrainian Cyber Forces recent efforts to block pro-Russian financing claim to close 128 terrorists accounts with over 1 Million $. (http://uapress.info/ru/news/show/48475 - in Russian)

Ukrainian law enforcers know Eugene Dokukin and his group. They don't give him visible troubles for his activities which are not according to law. Neither they confirm he is working for the government. But speaking anonymously one of the law enforcers said to Focus.UA: “Intelligence agencies often use the services of hackers in exchange for a guarantee of immunity. This does not mean that it's how things are in the Dokukin's case. But one can easily frame him: the bank will order a security audit - "network vulnerability pentesting" and the contract is made. But one security officer in the bank is told about it, others - no. The latter, seeing the external interference, scanning and active attempts to crack, report to authorities about unauthorized access to the system. And then the hacker will be "proving long and tedious that he is white and innocent." ( http://focus.ua/country/319358/ - in Russian)

Posted by Wapack Labs EURASIA desk

Nov 25, 2014 9:35:58 PM

NATO cyber exercises & regional tensions

Wapack Labs tracks cyber activities between Ukraine and Russia with the idea that that there will be lessons that we can all learn from, taking those lessons to our defenses. This piece was published by an analyst in Wapack Lab's EURASIA analysis effort. The analyst, a non-English speaker has a rough writing style but the content always offers amazing insights. 

Enjoy.

Jeff

NATO cyber exercises & regional tensions

Published 11/24/14

Annual NATO cyber exercises "Cyber Coalition 2014" attracted a lot of attention: NATO estimates global cyber crime makes a profit of $1 TRN a year - equivalent to the narcotics trade. NATO's computer servers are detecting 200 million suspicious cyber events every single day, the alliance has revealed. On average the military organisation is the victim of five major cyber attacks each week and that has increased "significantly" since Russian aggression in Ukraine started. https://uk.news.yahoo.com/natos-cyber-war-games-amid-surge-attacks-020403587.html

http://img.rt.com/files/news/21/49/80/00/8.si.jpg

NATO carried out its biggest ever cyber security exercise involving hundreds of computer analysts. The three-day event, taking in 28 nations, was held on a former Soviet base in the city of Tartu, close to the Russian border. Estonia, the host nation, was attacked by Russian hackers in 2007. Banking systems, newspaper production and national websites were all affected. Since then the country has invested heavily in cyber capability and is now one of the leading nations in NATO. Estonia's president Toomas Hendrik told Sky News his country had notice a surge in attacks since Russian aggression increased in Ukraine. He also revealed there had been a recent major attack on the country, but declined to reveal specifics. https://uk.news.yahoo.com/natos-cyber-war-games-amid-surge-attacks-020403587.html

The three-day cyber defence exercise Cyber Coalition 2014 tested the Alliance’s ability to defend its networks from the various challenges. It involved over 670 technical, government and cyber experts operating from dozens of locations from across the Alliance and partner nations. For the first time, representatives from academia and industry had been invited as observers. https://ccdcoe.org/centre-contributes-natos-largest-ever-multinational-cyber-defence-exercise.html

Financial Times in the article “Nato holds largest cyber war games” gives the idea of exercises and connection to Russian-Ukrainian military conflict:

From barracks in Tartu, a team of around 100 soldiers and intelligence officials on Monday began throwing sophisticated technical attacks at NATO teams across Europe and North America: Troops’ android phones were hacked after a downloadable app turned out be hiding sophisticated malware; an imaginary supplier of military equipment was found to have had its own manufacturing process compromised, with security loopholes built into its computer chips; a Nato emergency response team was flown to Greece after one scenario in which the attackers succeeded in seizing control of the systems running Nato’s Awacs surveillance aircraft – one of the alliance’s most prized possessions.

In a particularly lurid cyber storyline, a senior NATO officer had his family kidnapped and was then blackmailed into stealing huge amounts of classified data from the alliance’s secure military networks.

“Eventually,” said Luc Dandurand, deputy director of the exercise, “[the participants] work out that all these attacks are coming from a single entity – it’s all from one nation state.”  Officially, the attacker was meant to be disrupting a Nato mission in a fictitious, war-torn state in the Horn of Africa. In reality, the scenario was a thinly disguised version of the threats confronting the alliance as a result of the crisis in Ukraine. Russia, though never mentioned, loomed large.  In one simulated attack, for example, the classified communications of the general in charge of the fictitious Nato deployment were hacked. The hackers then leaked the information to a global newspaper, which promptly published the Nato military chief’s private declaration that the war was unwinnable.

That was eerily reminiscent of an episode in Kiev in February when a candid conversation between US assistant secretary of state Victoria Nuland and Washington’s ambassador to Ukraine, Geoffrey Pyatt, was secretly recorded and leaked to the press.
http://www.ft.com/intl/cms/s/0/9c46a600-70c5-11e4-8113-00144feabdc0.html

Why Manufacturing?

I spent a day over the weekend with a good friend.  I told him that we'd done an incident response on

http://www.exelisinc.com/

a small manufacturing company.  He asked what they did, and I told him that they work with aluminum, and they manufacture all kinds of things, including heat sinks for various components.

Why do you ask? I asked him.

And then he explained something in a way, with a new perspective that I hadn't thought of.  My (simple) assumption was that the intellectual property was the target, but this guy, a technologist presiding over a large manufacturing company assured me that my assumption was flawed. Here it is...

So this company manufactures heat sinks. My assumption was that attackers wanted the heat sinks. NOOOO!

Think complex.  Heat sinks are manufactured to run coolant through channels that are cut into the metal. They may be really small, but at electrically significant spacing. This precision is incredibly hard to do.  Attackers don't want the fish, they want to learn how to fish! They want to learn how to do this type of precision machining so they can pump them out themselves.

The same holds true with optics --lasers, scopes, and any kind of high precision optic grinding. They want the process.

I feel like I've been whacked in the head to make the lightbulb come on!

Introducing Rod Castillo, Managing Director for OEM and Integration

It's been a heck of the week, and I'm happy as a hatter knowing we brought on a new Managing Director in the Lab this week.

Rod Castillo is handling our OEM Integration projects for Threat Recon.  We've had an enormous amount of interest in companies hitting the Threat Recon API, and with nearly a dozen integrations in the works, it seemed like the right time to bring someone in to assist.

Rod comes at this from an application security background. We worked together years ago at PwC.. my stint was much shorter than his.  Since then, he's been the CISO for Wyndham Hotels, and a consultant for Level 9, and now takes on a new role with us as Managing Director for OEM Integration, Wapack Labs.

We're bringing him up to speed, but he's a heck of a nice guy, smart as hell, and ready to jump in and assist in getting Threat Recon integrated into your environment. Check him out on Linkedin. Rod can be reached at rcastillo@wapacklab.com.

What's old is new again! Pay no attention to the Russian spyplanes!

I never did receive my Cold War medal, but heck, these days it's pretty much an afterthought for me anyway. I've got to laugh however. I'm preparing to do a talk next week in Pittsburgh. It's going to focus on the Ivanof doctrine and show up to date timing on how Putin does "new generation" warfare... and phase two of this plan calls for a deception plan --a rouse --to take the focus off of his real objective. Today, that objective is regaining control over pipelines in Eastern Ukraine.

They've been buzzing Sweden. Lost a sub on a fiber node off the coast of Stockholm, and today announced we'll start seeing Bears flying off the east coast.

NATO has upset Putin with their anti-Russian sentiment? Imagine that.

What is Movember?

I've been asked several times in the last week or so "Why are you growing that ugly beard?"

I've been asked if I was homeless, so I finally got a good haircut (manscaping?) to make sure that even with the spotty facial hair that comes from what my grandmother used to tell us was the American Indian side, I still look gooooooooooooddddddd.

So on that... what is Movember, and why is Stutzman going with the homeless look? Because it sparks conversation around men's health. And if you want to contribute money and be involved, check out the official Movember website. It's the real deal. And when you've got family members (like I do) who currently have prostrate cancer, and you think about it every day because the guy is eight months older than me, and you wonder what it must be like to be 52 years old and going through this, the idea of growing facial hair (mine really is bad) for a month to generate conversation is a small price to pay, and maybe, just maybe, it'll help someone.

So when you see me in MD/DC this week, or in Pittsburgh next --I'll be on the podium at a the NIST conference at Pitt --and chuckle at my feeble attempt to show support, know this.. it's for a really good reason... stop me and ask me about it.

Automating Victim Notifications - 1800 unique victims notified today

Wapack Labs has been running sinkholes since early April of this year. Up until recently we have been performing manual victim notifications however recent activity forced us to automate. Two recently sink-holed domains started generating a large quantity of traffic. One was from an old worm that has been around since 2010 but is apparently still
propagating.

http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm:Win32/Esfury

The second is from a malware variant detected as Troj/Neurevt-K

http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Neurevt-K/detailed-analysis.aspx

In less than a week of monitoring, a total of 19561 victims checked into our sinkhole. Amongthe total victims, there were approximately 1800 unique networks and/or ISPs. As part of the notifications, we are providing the victim data, destination domains and timestamps of activity. If you received one of these notifications and need more clarification, shoot us a note at notifications[at]wapacklabs.com.

Jeff

The sh*t heading toward the fan? North Korea and nuke weps?

It should come as no surprise that North Korea is building nuclear weapons, and, it should come as no surprise that they'd probably like to use them on American targets and local neighbors (although the fallout would probably head north with the wind... I'm not sure they're ready for mass radiation poisoning.).. so I'll assume they're being made for American targets.

Im curious... were the PLCs made by Siemens?

Wirelurker?

For all of you Mac users (like me) and IOS users (not like me, but there are a ton of you), Wirelurker is new interesting in the threat category.  Palo Alto published a great tech piece on the new malware, but didn't do a great job of telling what it does and why it's bad, so here you go...

It's bad. It's another class of malware that opens your system up for access by outsiders. For the non-geeks reading this, know this... you need to check for it, and if you've got it, get rid of it.

The Palo Alto report can be found here.

They've also published a script that can be used to check your system. It's easy to use. Copy and paste the commands into Terminal and hit enter. I've copied the Palo Alto's instructions from their GitHub below.

Usage

1. Open the Terminal application in your OS X system;
2. Execute this command to download the script:
   curl -O https://raw.githubusercontent.com/PaloAltoNetworks-BD/WireLurkerDetector/master/WireLurkerDetectorOSX.py
3. Run the script in the Terminal:
   python WireLurkerDetectorOSX.py
4. Read the output messages and detection result.

For any issue on the code and its result, please create a issue here:https://github.com/PaloAltoNetworks-BD/WireLurkerDetector/issues

This is AWESOME!! AirHopper - Hacking via FM Radio signals!

THIS IS AWESOME! Do you have any idea how many times I've fired up my shortwave radio and

listened to some far away place (from a really secure place --if course it was an approved device --I'm just sayin!) just for some entertaining white noise while I focused on something else?  And no, I don't trust internet radio to not place something on my machine --intentionally or unintentionally!

I'm a huge fan, and a long time amateur radio operator.  This really takes me back.  I remember (ahem, hypothetically of course) clipping the band pass filters on my 2 and 6 meter rigs to listen in on other frequency ranges (I won't say which ranges); screwing with a Sun Sparq 20 generating packet radio in early experiments between routers and repeaters (some even worked!), but the idea of hacking a computer via frequency modulation (FM radio signals) is AWESOME! In my minds eye I can see some ways this would be logical, but never thought I'd see the day.  Pay attention folks! The game changes yet again, and neither air gapping or disabling internet connections is going to help! Ah yes, radio frequency. Gotta love it!

Where do they come up with this stuff??

You've got to check out the video! (of course, at your own risk!)

SCHWEEEEETTT

You've heard me say it before. I'm a believer that if someone breaks into my home in the middle of the night and threatens me or my family, I should have the right to defend myself, my family, and my

property. And I'm a believer that my second amendment rights should extend to cyber space as well.  If someone breaks into my computer in the middle of the night, not only should I have the ability to defend myself, but also fight back. There will be consequences for sure, and when hitting someone bigger, faster, or smarter, I may just get my clock cleaned. And if I shoot and hit the wrong guy, well, again, consequences...

So why the heck are we sitting back taking it? Well, at least one country believes enough is enough. The Netherlands says that they will start hacking back in 2015. Good, bad, right, wrong, or indifferent as you might think, my feeling is this opens up a whole new can of worms. I think it's a game changer.

Thinking differently...

This is awesome (not really!) but it goes directly to something I heard just the other day.

When most computer guys think intelligence, they think packets, bytes, bits, etc.

When I think intelligence, I think... how do I think like the other guy? What's he going to do? How would he operate against someone? What motivates him/her?

So someone mentioned to me that when doing business in Russia, the company had to assign someone (full time) to watch for changes in laws (mostly tax laws) that happen over night, that if not caught, would cause harsh and immediate fines (yet another revenue opportunity). And I though to myself, That's pretty extreme! Would we really need to hire someone full time??

And today, this piece from the NY Times. Yes, others in the world do think differently. And where Putins friends stand to profit, laws (apparently) can change on a dime.

Have a read!

Hiring an MSSP?

I've been reading Anton's running commentary on hiring and using an MSSP, and I had to comment.

Wapack Labs does backend work for incident response teams who don't have the ability to do it themselves. Get your blood drawn? It probably goes to a lab for workup. We do the workup.

Yesterday, we (Wapack Labs) out-briefed a report on a case where a small (100 person) company had been breached... standard stuff (although not for them!). Spyware delivered Zeus, which delivered Crytpolocker, which of course, held them (the CEO) hostage until he paid a $600 bitcoin ransom, encrypting his files, and presumably more. But it's not the incident that had me scratching my head, it's that when we passed them a half dozen Command and Control IP addresses and domains, and told him to put them in his UTM (he's got a Sonicwall) and monitor for a few minutes to see who they're talking to internally, he had no idea what I was talking about. These guys simply were not prepared.. and they probably had no clue until recently that this stuff even existed.

The company has SSL VPNs, a Sonicwall UTM, and that's about it as far as we can tell. The IT staff is one guy.

The CEO thought they were safe.

So here's the deal... His company -a manufacturing company, has computers, but is primarily a machine shop. So what's he to do? In his case, more IT (Security) is an overhead cost in an already competitive, tight margin business... so what's he to do? Rent or buy?

My recommendation to him? Rent. Focus on his core business of making widgets.

He's already asked for recommendations - we work with four MSSPs --who all use the intel from either Red Sky Alliance or the lab (or both) to protect their customers. We've passed on recommending others, simply because the customer feedback we receive about them has been, well, less than stellar.

Look, for a company who prefers to focus on their core, MSSP is a wonderful thing, but its got to fit your use model, and you've got to know what you're going to get. In the mean time, the idea of installing a suite of security tools, hiring a team, and budgeting those increasingly hard to maintain margins comes at a high price for manufacturing companies like the one we visited. MSSP's, when used correctly, are a GREAT alternative.

Change in blog format

I've taken a bit of a different tact on blogging of late. Rather than point out hard issues (that sometimes get fixed, sometimes not), I've started posting through the week. Posts to the Henrybasset Blog announce in Twitter, Linkedin, and Facebook but because of both issues associated with the use of a mailer system, I'm going to temporarily hold on announcing via email. If you'd like to receive updates from my blog, please feel free to sign on, follow me on twitter at @henrybasset, Google+, or Linkedin.

I'm keeping it short this morning... daughter's testing for High School admissions (can you imagine!).

Have a great weekend. Keep an eye out through the week. I'll be posting!

jeff

Moscow, Beijing poised to sign deal on joint cyber security ops

This is interesting to me.

"A draft treaty apparently outlines mutual agreement to the use of online operations to interfere with independent states in a bid to undermine sovereignty or disrupt social, economic or political order."

The idea that Russia and China are reportedly signing an agreement on November 10th for joint us of online operations is amazing to me.  For those of you who've heard me talk,  I talk much about the idea of disintermediation... taking out the middle man.  Who, do you think independent states might be?  I'm guessing the US, maybe Sweden (just a wild guess after Russian flyovers, and a submarine off the coast of Stockholm), maybe Poland and Ukraine? Regardless,  if you think for a moment that infrastructures in China are only used by Chinese hackers today, you're wildly mistaken.  The sky isn't falling, but once these guys figure out how to working together (all new partnerships go through forming, storming, norming and performing... we'll see how long it takes)... but once they figure it out, the game changes.

Poles who spied for Russia?

We've been tracking the Russia | Ukraine conflict for about a year, and last month one of our analysts speculated that we'd see cyber activity hitting Polish targets. It should come as no surprise. Poland has been looking for opportunities to reduce their dependence on Russian gas, which btw, travels through pipelines in Ukraine... seeing any patterns?

So this crossed my radar tonight when I had a few moments to settle in for the night. Intelnews has been talking about Russian spies in Poland.  Intelnews is one of my favorite sites for non-technical, geopolitically focused intelligence... and this is the third such piece I've seen in two days. And with the thought that Russia will continue to regain control, if not over Ukraine, then over the lines that pass their fuel to the EU, and also over those who attempt to find other sources, it is our belief that Poland will not only land in the crosshairs of foreign intelligence (from Russia), but also that we'll see the Putin/Ivanov cyber playbook continue, but with expanded new targeting.

So I scratch my head. With Cyber Berkut (a Ukranian, pro-Russian hacker group) hitting the Warsaw Exchange in August, and the reporting of Russian intelligence operating in Poland... does it make sense that we see ISIS messaging in files pulled from Warsaw Exchange today? I'm not jumping to conclusions, only looking at the pile of data with one eye closed and the other in a hard squint.

If it walks like a duck, quacks like a duck, and leaves little piles around my pond... Well, we're keeping an eye out for swimmers scooting over the water.

Warsaw Stock Exchange whacked? Cyber Berkut?

Pastebin indications of the Warsaw Stock Exchange. Here's the first reporting we've seen after reporting it to our members and customers.

According to other reporting, several thousand passwords and files leaked.  Apparently, there were also attacks attributed to Cyber Berkut in August. If you were at the FS-ISAC summit, I told you the Cyber Berkut and Green Dragon.. they've also been used to attack a Ukrainian bank and governments in the EU.

iCloud... and of course, Apple's response

It doesn't call out attacks from China, but Apple does respond.. if you didn't know how to check it (I'm assuming that if you read my blog, you probably do... I hope you do...). But here's Apple's directions on how to check the digital certificate associated with the iCloud website.

http://support.apple.com/kb/HT6550?viewlocale=en_US&locale=en_US

"The iCloud website is protected with a digital certificate. If users get an invalid certificate warning in their browser while visiting www.icloud.com, they should pay attention to the warning and not proceed."

I have a couple of thoughts on this.. you knew I would.

First, the iCloud website is indeed NOT protected by a digital certificate. The digital certificate in and of itself is part of a protection scheme, but I wouldn't hang my hat on a digital certificate keeping bad guys out of iCloud.

Second, leaving this to users to check, 'pay attention to the warning and not proceed' strikes me smack in the funny bone. I want to laugh, but it hurts when I get hit there. Check that digital cert every time you log in. I wonder if my mom will check it when she logs in. Will yours?

China in iCloud? Like a freakin sticky booger!

Apple iCloud is (allegedly) fully of Chinese hackers, grabbing personal photos, personal information, and presumably, my iTunes library! I'm thinking there's a simple and easy defense. Let them find my P90X starting pictures it'll scare 'em off for good! They'll never come back!

http://thehill.com/policy/cybersecurity/221435-chinese-government-suspected-of-launching-apple-cyberattack

Regardless, these guys keep coming back. So two things.. Chinese hackers as I know them aren't as much interested in personal information -that's the domain of others, more interested in intellectual property and targeting Falun Gong. The MO (to me) sounds more like someone else using a Chinese infrastructure to pull off something more. iCloud isn't exactly known for hosting business, so I'm thinking (speculating only) that it's PII that the attackers might be after (or maybe they'll find the pictures of the iPhone 7??). To the money guys (meaning carders) full identities mean more money --PINs are more easily reset. 

So is it Chinese? Is it somoene else using Chinese tools? Tell me more!

Jeff